[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n
<\/span> Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification or destruction of all data, or performing a business function outside of the limits of the user.<\/p>\n The vulnerability that merits mention, is the hardcoded encryption\/decryption key used in the Lexware client. At a glance, the process setup works by encrypting the user delivered password by the client and delivering the same to the database and the decrypting works vice-versa, wherein encrypted password is fetched from the database and decrypted by the Lexware client. Even though this might appear a sound process on a first look, the presence of decrypting algorithm implies an alternate method to obtain user passwords. A simplified option would be to use the client\u2019s decryption feature to do the work.<\/p>\n For example, in the user management options, the decrypted password is hidden by the client with a dot option. This highly simplified method can be easily bypassed with existing tools.<\/p>\n <\/span><\/p>\n A sample screenshot is provided to enhance the ease of understanding. It shows the decrypted administrator password.<\/span><\/p>\n [\/et_pb_text][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/lexware_hardcoded_key_screenshot.png\" title_text=\"lexware_hardcoded_key_screenshot\" _builder_version=\"4.9.4\" _module_preset=\"default\" custom_margin=\"27px||43px||false|false\" hover_enabled=\"0\" sticky_enabled=\"0\"][\/et_pb_image][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n
Advisory ID<\/strong>: usd-2018-0017<\/span>
CVE Number<\/strong>: N\/A<\/span>
Affected Product<\/strong>: Lexware Professional 2017<\/span>
Affected Version<\/strong>: 17.02<\/span>
Vulnerability Type<\/strong>: Broken Authentication<\/span>
Security Risk<\/strong>: Critical<\/span>
Vendor URLL<\/strong>: <\/span>https:\/\/shop.lexware.de\/reisekosten-abrechnung<\/a>
Vendor Status<\/strong>: Fixed<\/span><\/p>\n<\/h3>\n
Description<\/h3>\n
Proof of Concept\u00a0<\/h3>\n